On Wed, Jun 04, 2025 at 03:27:53PM +0200, Hanna Czenczek wrote: > aio_poll() in I/O functions can lead to nested read_from_fuse_export() > calls, overwriting the request buffer's content. The only function > affected by this is fuse_write(), which therefore must use a bounce > buffer or corruption may occur. > > Note that in addition we do not know whether libfuse-internal structures > can cope with this nesting, and even if we did, we probably cannot rely > on it in the future. This is the main reason why we want to remove > libfuse from the I/O path. > > I do not have a good reproducer for this other than: > > $ dd if=/dev/urandom of=image bs=1M count=4096 > $ dd if=/dev/zero of=copy bs=1M count=4096 > $ touch fuse-export > $ qemu-storage-daemon \ > --blockdev file,node-name=file,filename=copy \ > --export \ > fuse,id=exp,node-name=file,mountpoint=fuse-export,writable=true \ > & > > Other shell: > $ qemu-img convert -p -n -f raw -O raw -t none image fuse-export > $ killall -SIGINT qemu-storage-daemon > $ qemu-img compare image copy > Content mismatch at offset 0! > > (The -t none in qemu-img convert is important.) > > I tried reproducing this with throttle and small aio_write requests from > another qemu-io instance, but for some reason all requests are perfectly > serialized then. > > I think in theory we should get parallel writes only if we set > fi->parallel_direct_writes in fuse_open(). In fact, I can confirm that > if we do that, that throttle-based reproducer works (i.e. does get > parallel (nested) write requests). I have no idea why we still get > parallel requests with qemu-img convert anyway. > > Also, a later patch in this series will set fi->parallel_direct_writes > and note that it makes basically no difference when running fio on the > current libfuse-based version of our code. It does make a difference > without libfuse. So something quite fishy is going on. > > I will try to investigate further what the root cause is, but I think > for now let's assume that calling blk_pwrite() can invalidate the buffer > contents through nested polling. > > Cc: qemu-sta...@nongnu.org > Signed-off-by: Hanna Czenczek <hre...@redhat.com> > --- > block/export/fuse.c | 24 +++++++++++++++++++++--- > 1 file changed, 21 insertions(+), 3 deletions(-)
Reviewed-by: Stefan Hajnoczi <stefa...@redhat.com>
signature.asc
Description: PGP signature
